Abnormal transaction processing method, device, equipment and storage medium

Abstract

The application provides an abnormal transaction processing method, device and equipment and a storage medium. The method comprises the following steps: acquiring at least one transaction information of N users in a preset time period, wherein N is an integer greater than 1; for any user in the N users, performing feature extraction on each transaction information of the user to obtain at least one transaction feature of the user; for any user in the N users, generating at least one transaction feature subsequence of the user according to the at least one transaction feature of the user, each transaction feature subsequence comprising continuous M transaction features of the user, wherein M is an integer greater than 1; and determining an abnormal payment user according to the at least one transaction feature subsequence of each of the N users. This method can determine the abnormal payment user of any risky transaction and has a certain universality.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of computer, and particularly relate to an abnormal transaction processing method and device, equipment and storage medium. BACKGROUND

[0002] With the continuous popularity of intelligent terminals, electronic transactions are becoming more and more frequent in people's lives. Therefore, the security of electronic transactions is crucial.

[0003] In the prior art, a model is trained by using a training set with labels such as fraud and gambling, and risk prediction is performed by using the trained model, for example, to predict abnormal payment users who perform risk transactions. However, since the training set has labels, this method cannot predict unknown risks when performing risk prediction, such as other labels in addition to the labels of the training set, and thus cannot predict abnormal payment users who perform unknown risk transactions. SUMMARY

[0004] The present application provides an abnormal transaction processing method, device, equipment and storage medium, which can determine abnormal payment users of any risk transaction and has a certain universality.

[0005] In a first aspect, the present application provides an abnormal transaction processing method, comprising: obtaining at least one transaction information of N users respectively in a preset time period, N being an integer greater than 1; for any user in the N users, performing feature extraction on each transaction information of the user to obtain at least one transaction feature of the user; for any user in the N users, generating at least one transaction feature subsequence of the user according to the at least one transaction feature of the user, each transaction feature subsequence comprising continuous M transaction features of the user, M being an integer greater than 1; and determining an abnormal payment user according to the at least one transaction feature subsequence of each of the N users.

[0006] In a second aspect, the present application provides an abnormal transaction processing device, comprising: an obtaining module, a feature extraction module, a generating module and a determining module, wherein the obtaining module is configured to obtain at least one transaction information of N users respectively in a preset time period, N being an integer greater than 1; the feature extraction module is configured to, for any user in the N users, perform feature extraction on each transaction information of the user to obtain at least one transaction feature of the user; the generating module is configured to, for any user in the N users, generate at least one transaction feature subsequence of the user according to the at least one transaction feature of the user, each transaction feature subsequence comprising continuous M transaction features of the user, M being an integer greater than 1; and the determining module is configured to determine an abnormal payment user according to the at least one transaction feature subsequence of each of the N users.

[0007] In a third aspect, a server is provided, comprising: a processor and a memory, the memory being configured to store a computer program, and the processor being configured to invoke and run the computer program stored in the memory to execute the method of the first aspect.

[0008] In a fourth aspect, a computer readable storage medium is provided, configured to store a computer program, the computer program causing a computer to execute the method of the first aspect.

[0009] In a fifth aspect, a computer program product is provided, comprising computer program instructions, the computer program instructions causing a computer to execute the method of the first aspect or any implementation manner thereof.

[0010] In a sixth aspect, a computer program is provided, when running on a computer, causing the computer to execute the method of the first aspect or any implementation manner thereof.

[0011] In summary, in the present application, the server can adopt an unsupervised learning manner, that is, according to at least one transaction feature of each user, at least one transaction feature sub-sequence of the user is generated, and according to at least one transaction feature sub-sequence of each of the N users, an abnormal payment user is determined. This method can determine the abnormal payment user of any risky transaction, and has certain universality. BRIEF DESCRIPTION OF DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0013] Figure 1 a schematic diagram of a transaction system provided in the present application;

[0014] Figure 2 a flowchart of an abnormal transaction processing method provided in the embodiments of the present application;

[0015] Figure 3 a flowchart of another abnormal transaction processing method provided in the embodiments of the present application;

[0016] Figure 4 a schematic diagram of an abnormal transaction processing device provided in the embodiments of the present application;

[0017] Figure 5 a schematic block diagram of a server 500 provided in the embodiments of the present application. DETAILED DESCRIPTION

[0018] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0019] It should be noted that the terms "first", "second" and the like in the description and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in other than the order illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or server including a series of steps or units does not necessarily limit to those clearly listed steps or units, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0020] Figure 1 The schematic diagram of the transaction system provided in the present application is shown in FIG. 1, which includes a server 11 and a terminal device 12, wherein the terminal device 12 can communicate with the server 11 through mobile communication technology or Wireless Fidelity (WiFi) technology, etc. Figure 1

[0021] It should be understood that Figure 1 only one server and two terminal devices are shown by way of example, and in fact, the transaction system can also include multiple servers and other numbers of terminal devices, which are not limited by the present application.

[0022] Optionally, the terminal device in the present application can be a smart terminal such as a mobile phone, a tablet, an electronic watch, an electronic bracelet, etc. The terminal device can realize data interaction with the server 11 through a web page or an Application (APP).

[0023] Optionally, the server is a server corresponding to a payment APP or a payment web page, and the server can be a cloud server.

[0024] Optionally, the transaction information, transaction features, transaction feature subsequences, etc. involved in the present application can be stored in a block chain, but are not limited thereto.

[0025] ​Blockchain is a new application mode of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm. Blockchain, in essence, is a decentralized database, which is a chain of data blocks associated using cryptographic methods, each of which contains information about a batch of network transactions, for verifying the validity of the information (anti-fake) and generating the next block. The blockchain can include a blockchain underlying platform, a platform product service layer, and an application service layer.

[0026] The blockchain underlying platform can include user management, basic services, smart contracts, and operation monitoring processing modules. Among them, the user management module is responsible for the identity information management of all blockchain participants, including maintaining the generation of public and private keys (account management), key management, and the maintenance of the correspondence between the real identity of the user and the blockchain address (permission management), and under authorization, supervising and auditing the transaction of certain real identities, providing rule configuration for risk control (risk audit); the basic service module is deployed on all blockchain node devices to verify the validity of business requests, and after consensus, the valid requests are recorded on the storage. For a new business request, the basic service first performs interface adaptation analysis and authentication processing (interface adaptation), then encrypts the business information through a consensus algorithm (consensus management), and after encryption, the complete and consistent transmission is transmitted to the shared ledger (network communication) and recorded and stored; the smart contract module is responsible for the registration and issuance of contracts, as well as the triggering and execution of contracts. Developers can define contract logic through a certain programming language, publish it to the blockchain (contract registration), call keys or other events to trigger execution according to the logic of the contract terms, complete the contract logic, and also provide contract upgrade and cancellation functions; the operation monitoring module is mainly responsible for the deployment, configuration modification, contract setting, cloud adaptation during product release, and the real-time state visualization output during product operation, such as alarm, monitoring network conditions, monitoring node device health status, etc.

[0027] The platform product service layer provides basic capabilities and implementation frameworks for typical applications. Developers can stack business features based on these basic capabilities to complete the blockchain implementation of business logic. The application service layer provides application services based on the blockchain solution for business participants to use.

[0028] As described above, in the prior art, model training is performed through a training set with labels such as fraud and gambling, and risk prediction is performed through the trained model, for example, to predict abnormal payment users for risk transactions. However, since the training set has labels, this method cannot predict unknown risks when predicting risks, such as other labels before the labels carried by the training set, and thus cannot predict abnormal payment users for unknown risk transactions.

[0029] To solve this technical problem, the present application adopts an unsupervised learning method to construct a transaction feature subsequence of each user, and determines an abnormal payment user according to the subsequence. This method can determine abnormal payment users of any risky transaction, and has a certain universality.

[0030] The technical solutions of the present application will be described in detail below:

[0031] Figure 2 A flowchart of an abnormal transaction processing method provided by an embodiment of the present application is shown in the figure. The execution subject of the method can be a server, a processor or a chip, etc. In the following, the server will be taken as the execution subject, and the abnormal transaction processing method will be exemplarily described. As shown in the figure, the method comprises the following steps: Figure 2

[0032] S210: Obtain at least one transaction information of each of N users in a preset time period, N being an integer greater than 1.

[0033] S220: For any user in the N users, extract features from each transaction information of the user to obtain at least one transaction feature of the user.

[0034] S230: For any user in the N users, generate at least one transaction feature subsequence of the user according to the at least one transaction feature of the user, each transaction feature subsequence comprising continuous M transaction features of the user, M being an integer greater than 1.

[0035] S240: Determine an abnormal payment user according to the at least one transaction feature subsequence of each of the N users.

[0036] Optionally, the preset time period can be a day or a time period of a day, etc. The present application does not limit this, for example: the preset time period is February 2, 2021, or from 12 noon to 8 pm on February 2, 2021.

[0037] It should be understood that each transaction information comprises: transaction type, transaction method, transaction amount, transaction time, transaction user, etc.

[0038] Optionally, the transaction type comprises: receiving money, paying money, withdrawing money, etc., but is not limited thereto.

[0039] Optionally, the transaction method comprises: receiving money by red packet, receiving money by transfer, receiving money by QR code, paying money by red packet, paying money by transfer, paying money by scanning code, etc., but is not limited thereto.

[0040] It should be understood that the transaction amount here refers to the actual transaction amount, for example: transferring 200, then the transaction amount is 200.

[0041] ​It should be understood that the transaction time here refers to the actual transaction time, for example: the transfer time is February 2, 2021, 15:50.

[0042] For example, assuming that the above preset time period is February 2, 2021, the transaction information of user A on this day is as follows:

[0043] Transaction information 1: payment, code payment, 5 yuan, February 2, 2021, 09:00;

[0044] Transaction information 2: payment, code payment, 17 yuan, February 2, 2021, 13:00;

[0045] Transaction information 3: collection, red envelope collection, 12 yuan, February 2, 2021, 13:30;

[0046] Transaction information 4: payment, transfer payment, 300 yuan, February 2, 2021, 20:40.

[0047] Optionally, after obtaining the transaction information of each user, the server can extract at least one of the following from each transaction information, but not limited to: transaction type, transaction method, transaction amount interval, transaction time interval, to obtain the transaction characteristics of each transaction information.

[0048] Optionally, the transaction amount interval and the transaction time interval can be pre-set by the server. For example, the transaction amount interval includes: 0-100 yuan, 100-300 yuan, 300-500 yuan, 500-1000 yuan, …, 10000 yuan or more. The transaction time interval includes: daytime and night.

[0049] For example, for the above 4 transaction information of user A, the feature extraction is performed on the 4 transaction information to obtain their respective transaction characteristics, as follows:

[0050] Transaction information 1: payment, code payment, 0-100 yuan, February 2, 2021, daytime;

[0051] Transaction information 2: payment, code payment, 0-100 yuan, February 2, 2021, daytime;

[0052] Transaction information 3: collection, red envelope collection, 0-100 yuan, February 2, 2021, daytime

[0053] Transaction information 4: payment, transfer payment, 100-300 yuan, 0-100 yuan, February 2, 2021, night.

[0054] Optionally, the server can generate at least one transaction feature sub-sequence of each user according to at least one transaction feature of the user by using n-gram algorithm.

[0055] Introduction of n-gram algorithm:

[0056] N-gram refers to n consecutive words in a text. N-gram model is a probability language model based on (n-1) order Markov chain, which infers the structure of a sentence by the probability of n words appearing. This model is widely used in probability theory, communication theory, computational linguistics (such as statistical natural language processing (NLP)), computational biology (such as sequence analysis), data compression, etc.

[0057] N-gram text is widely used in text mining and natural language processing tasks. They are basically a set of simultaneously appearing words within a given window, and when calculating n-gram, a word is usually moved forward.

[0058] For example, for the sentence "The cow jumps over the moon", n = 2 (called bigram), then the n-gram is:

[0059] the cow

[0060] cow jumps

[0061] jumps over

[0062] over the

[0063] the moon

[0064] Therefore, in this case, the sentence has 5 n-grams.

[0065] If n = 3, then the n-gram is:

[0066] the cow jumps

[0067] cow jumps over

[0068] jumps over the

[0069] over the moon

[0070] Therefore, in this case, the sentence has 4 n-grams.

[0071] Therefore, the number of n-grams in a sentence satisfies the following formula: Ngrams(K)=X-(n-1)

[0072] wherein X is the number of words in a given sentence K, and n is the number of consecutive words included in the n-gram.

[0073] The following will illustrate how to generate at least one transaction feature subsequence of a user by using the n-gram algorithm:

[0074] Suppose the four transaction features of the user A are respectively denoted as a, b, c, and d, and n=2 in the n-gram, then the transaction feature subsequences of the user A include: ab, bc, and cd.

[0075] It should be noted that the technical solution of the present application is not limited to generating transaction feature subsequences by using the n-gram algorithm, for example, the skip-gram algorithm can also be used to generate transaction feature subsequences, which is not limited in the present application.

[0076] Optionally, the server merges adjacent transaction features of any user in the N users if the adjacent transaction features of the user satisfy a preset condition.

[0077] In an optional manner, the preset condition is that the adjacent transaction features are the same. For example, for the user A, the transaction feature of the transaction information 1 and the transaction feature of the transaction information 2 are the same.

[0078] In another optional manner, the preset condition is that the difference between the corresponding features of the adjacent transaction features is less than a preset threshold. For example, suppose the user A has a transaction information after the transaction information 2, and the transaction feature of the transaction information includes: payment, scanning code payment, 100-300 yuan, February 2, 2021, daytime; the difference between each feature of the transaction feature and the transaction feature of the transaction information 2 is: 0, 0, 100-200 yuan, and 0, and the threshold of the transaction amount interval is 100-300 yuan, and the threshold of other features is 20, so the difference between each feature of the transaction feature and the transaction feature of the transaction information 2 is less than the corresponding threshold.

[0079] Optionally, the server merges the adjacent transaction features, including: deleting one of the adjacent transaction features. For example, the transaction feature of the transaction information 1 and the transaction feature of the transaction information 2 are the same, so the server can delete the transaction feature of the transaction information 1 or the transaction feature of the transaction information 1.

[0080] It should be noted that the server can delete a transaction feature in the adjacent transaction features according to a preset rule, for example, the preset rule is to delete a previous transaction feature in the adjacent transaction features, or to delete a next transaction feature in the adjacent transaction features. The preset rule is not limited in the application.

[0081] Optionally, after obtaining the at least one transaction feature subsequence of each of the N users, the server can determine the abnormal payment user by using a Term Frequency-Inverse Document Frequency (TF-IDF) algorithm or an Isolation Forest algorithm.

[0082] Optionally, the server can intercept the transaction of the abnormal payment user, or push an alarm message to a user who trades with the abnormal payment user. Alternatively, both the transaction of the abnormal payment user and the alarm message to the user who trades with the abnormal payment user are pushed.

[0083] Optionally, the alarm message can be a voice message, a text message, or other forms of alarm messages, which are not limited in the application.

[0084] In summary, in the application, the server can use an unsupervised learning method, that is, for any user in the N users, at least one transaction feature subsequence of the user is generated according to at least one transaction feature of the user, and an abnormal payment user is determined according to the at least one transaction feature subsequence of each of the N users. This method can determine the abnormal payment user of any risky transaction, and has a certain universality.

[0085] As described above, after obtaining the at least one transaction feature subsequence of each of the N users, the server can determine the abnormal payment user by using a TF-IDF algorithm.

[0086] The TF-IDF algorithm is a commonly used weighting technique for information retrieval and text mining.

[0087] The TF-IDF algorithm is a statistical method used to evaluate the importance of a word to a file set or a document in a corpus. The importance of a word increases in direct proportion to the number of times it appears in a file, but decreases in inverse proportion to the frequency of its occurrence in the corpus.

[0088] The main idea of the TF-IDF algorithm is that if a word appears frequently in an article and rarely in other articles, it is considered that the word or phrase has good class distinction ability and is suitable for classification.

[0089] (1) Term Frequency (TF)

[0090] TF represents the frequency of a term (keyword) in a certain document.

[0091] TF is usually determined at the same time as follows:

[0092]

[0093] where n ij is the number of times the i-th term (keyword) appears in the document d j , n kj is the number of times the k-th term (keyword) appears in the document d j , and thus the denominator represents the sum of the number of times all terms (keywords) appear.

[0094] (2) Inverse Document Frequency (IDF)

[0095] IDF represents the IDF of a certain term (keyword), which can be obtained by dividing the total number of documents by the number of documents containing the term (keyword), and then taking the logarithm of the resulting quotient. It can be determined by the following formula.

[0096]

[0097] where |D| is the total number of documents in the corpus. |{j:t i ∈d j}| represents the number of documents containing the term (keyword) t i . If t i is not in the corpus, it will result in a denominator of zero, so in general the denominator can be 1+|{j:t i ∈d j}|.

[0098] If the number of documents containing the term t is smaller, the IDF is larger, which means that the term has good class distinguishing ability.

[0099] (3) TF-IDF is actually: TF*IDF

[0100] High term (keyword) frequency in a particular document, as well as low document frequency of the term (keyword) in the entire document set, can produce high-weight TF-IDF. Therefore, TF-IDF tends to filter out common terms (keywords) and retain important terms (keywords).

[0101] Calculate the TF*IDF of each term (keyword), which can measure the class distinguishing ability of each term (keyword), that is, the larger the TF*IDF, the better the class distinguishing ability of the corresponding term (keyword), and vice versa.

[0102] The following will be illustrated by the following examples how to determine the abnormal payment user by using TF*IDF:

[0103] Figure 3 Another flowchart of an abnormal transaction processing method provided by the embodiment of the present application is shown in the figure, and the execution subject of the method can be a server, a processor or a chip, etc. In the following, the server is taken as the execution subject, and the abnormal transaction processing method is exemplarily described as follows. Figure 3 As shown in the figure, the method comprises the following steps:

[0104] S310: Obtain at least one transaction information of each of N users in a preset time period, and N is an integer greater than 1.

[0105] S320: For any user in the N users, feature extraction is performed on each transaction information of the user to obtain at least one transaction feature of the user.

[0106] S330: For any user in the N users, at least one transaction feature subsequence of the user is generated according to the at least one transaction feature of the user, and each transaction feature subsequence comprises continuous M transaction features of the user, and M is an integer greater than 1.

[0107] S340: For any transaction feature subsequence in the at least one transaction feature subsequence of each of the N users, determine the first probability and the second probability of the transaction feature subsequence.

[0108] S350: Calculate the product of the first probability and the second probability of the transaction feature subsequence to obtain the probability product of the transaction feature subsequence.

[0109] S360: Determine the abnormal payment user according to the probability product corresponding to the at least one transaction feature subsequence of each of the N users.

[0110] It should be understood that the explanation and description of S310 to S340 can refer to the above embodiment, and the present application will not repeat it here.

[0111] The first probability is the probability of the transaction feature subsequence appearing in all transaction feature subsequences of the user to which the transaction feature subsequence belongs, that is, the first probability is the aforementioned TF. The second probability is obtained by taking the logarithm of a first quotient, the first quotient being a quotient of all user numbers divided by user numbers containing the transaction feature subsequence, that is, the second probability is the aforementioned IDF. Alternatively, the second probability is obtained by taking the logarithm of a second quotient, the second quotient being a quotient of all user numbers divided by 1 plus user numbers containing the transaction feature subsequence, that is, the second probability is the aforementioned IDF.

[0112] Optionally, before S350, the server can delete any transaction feature subsequence from the at least one transaction feature subsequence of each of the N users, if the first probability of the transaction feature subsequence is less than a preset probability. For example, the first probability of a certain transaction feature subsequence is 5%, and the preset probability is 10%. In this case, the server will delete the transaction feature subsequence.

[0113] It should be understood that in the present application, the preset probability can be 10%, 20%, etc., which is not limited in the present application, and the server can be preconfigured.

[0114] Optionally, the server can determine the abnormal payment user in any of the following ways:

[0115] Optionally, the server determines the user corresponding to the transaction feature subsequence with the maximum product of the probabilities from the at least one transaction feature subsequence of each of the N users as the abnormal payment user.

[0116] Optionally, the server determines the top P transaction feature subsequences in descending order of the product of the respective probabilities from the at least one transaction feature subsequence of each of the N users, P being a positive integer, and determines the users corresponding to the top P transaction feature subsequences as the abnormal payment users.

[0117] Optionally, the server determines the top P transaction feature subsequences in descending order of the product of the respective probabilities from the at least one transaction feature subsequence of each of the N users, P being a positive integer, and determines the users corresponding to the top P transaction feature subsequences as the suspected abnormal payment users. For any payee in the N users, the server determines the proportion of the suspected abnormal payment users in the payees corresponding to the payee. If the proportion of the suspected abnormal payment users in the payees corresponding to the payee is greater than a preset proportion, the payee is determined as the abnormal payment user. This way of determining the abnormal payment user is also referred to as the dyeing aggregation method.

[0118] It should be understood that the user corresponding to a certain transaction feature subsequence refers to the user to which the transaction feature subsequence belongs when calculating the first probability of the transaction feature subsequence.

[0119] The above optional mode two and optional mode three are described below through two examples:

[0120] Example 1, assuming that the server determines the first three transaction feature subsequences as transaction feature subsequence 1, transaction feature subsequence 2 and transaction feature subsequence 3 in descending order of the respective probability products of the at least one transaction feature subsequence of each of the N users, and the transaction feature subsequence 1, transaction feature subsequence 2 and transaction feature subsequence 3 correspond to the users 1, 2 and 3 respectively, based on this, the server determines the users 1, 2 and 3 as abnormal payment users.

[0121] Example 2, assuming that the server determines the first three transaction feature subsequences as transaction feature subsequence 1, transaction feature subsequence 2 and transaction feature subsequence 3 in descending order of the respective probability products of the at least one transaction feature subsequence of each of the N users, and the transaction feature subsequence 1, transaction feature subsequence 2 and transaction feature subsequence 3 correspond to the users 1, 2 and 3 respectively, based on this, the server determines the users 1, 2 and 3 as suspected abnormal payment users. Assuming that the user 4 is the payee, the proportion of suspected abnormal payment users is 50%, which is greater than the preset proportion 20%, then the server determines the user 4 as an abnormal payment user.

[0122] In summary, in the present application, the server can determine the first probability and the second probability of any transaction feature subsequence in the at least one transaction feature subsequence of each of the N users, calculate the product of the first probability and the second probability of the transaction feature subsequence to obtain the probability product of the transaction feature subsequence, and finally determine the abnormal payment user according to the probability product corresponding to the at least one transaction feature subsequence of each of the N users. This method can determine the abnormal payment user of any risk transaction, and has a certain universality.

[0123] Further, in the present application, the server can also delete the transaction feature subsequence with the first probability less than the preset probability, so as to reduce the calculation amount of the overall scheme, thereby improving the efficiency of determining abnormal transactions.

[0124] Figure 4 A schematic diagram of an abnormal transaction processing device provided by an embodiment of the present application is shown in FIG. 4, which includes: Figure 4

[0125] The acquisition module 410 is configured to acquire at least one transaction information of N users in a preset time period, and N is an integer greater than 1.

[0126] ​The feature extraction module 420 is configured to extract features of each transaction of a user to obtain at least one transaction feature of the user for any one of the N users.

[0127] The generation module 430 is configured to generate at least one transaction feature subsequence of a user according to at least one transaction feature of the user, each transaction feature subsequence including continuous M transaction features of the user, M being an integer greater than 1, for any one of the N users.

[0128] The determination module 440 is configured to determine an abnormal payment user according to at least one transaction feature subsequence of each of the N users.

[0129] Optionally, the determination module 440 is specifically configured to determine a first probability and a second probability of any one of the at least one transaction feature subsequence of each of the N users, calculate a product of the first probability and the second probability to obtain a probability product of the transaction feature subsequence, and determine the abnormal payment user according to the probability product corresponding to the at least one transaction feature subsequence of each of the N users. The first probability is a probability of the transaction feature subsequence appearing in all transaction feature subsequences of the user to which the transaction feature subsequence belongs. The second probability is obtained by taking a logarithm of a first quotient or a second quotient, the first quotient being a quotient of a total number of users divided by a number of users including the transaction feature subsequence, and the second quotient being a quotient of the total number of users divided by 1 plus the number of users including the transaction feature subsequence.

[0130] Optionally, the determination module 440 is specifically configured to determine the first P transaction feature subsequences in a descending order of the respective probability products of the at least one transaction feature subsequence of each of the N users, P being a positive integer, and determine the abnormal payment user according to the users corresponding to the first P transaction feature subsequences.

[0131] Optionally, the determination module 440 is specifically configured to determine the users corresponding to the first P transaction feature subsequences as the abnormal payment users.

[0132] Optionally, the determination module 440 is specifically configured to determine the users corresponding to the first P transaction feature subsequences as suspected abnormal payment users, determine a proportion of the suspected abnormal payment users in the payers corresponding to any one of the N users, and determine the abnormal payment user if the proportion of the suspected abnormal payment users in the payers corresponding to the any one of the N users is greater than a preset proportion.

[0133] Optionally, the apparatus further comprises a deleting module 450 configured to delete, for any one of the at least one transaction feature subsequence of each of the N users, the transaction feature subsequence if the first probability of the transaction feature subsequence is less than a preset probability before the determining module 440 calculates the product of the first probability and the second probability of the transaction feature subsequence to obtain the probability product of the transaction feature subsequence.

[0134] Optionally, the generating module 430 is specifically configured to generate, for any one of the N users, the at least one transaction feature subsequence of the user according to the at least one transaction feature of the user by using an n-gram algorithm.

[0135] Optionally, the apparatus further comprises a merging module 460 configured to merge, for any one of the N users, adjacent transaction features if the adjacent transaction features satisfy a preset condition before the generating module 430 generates, for any one of the N users, the at least one transaction feature subsequence of the user according to the at least one transaction feature of the user by using an n-gram algorithm.

[0136] Optionally, the preset condition is that the adjacent transaction features are the same.

[0137] Optionally, the transaction features comprise at least one of the following: transaction type, transaction manner, transaction amount interval, and transaction time interval.

[0138] Optionally, the apparatus further comprises an intercepting module 470 configured to intercept transactions of the abnormal payment user after the determining module 440 determines the abnormal payment user according to the at least one transaction feature subsequence of each of the N users.

[0139] Optionally, the apparatus further comprises a pushing module 480 configured to push an alarm message to a user who trades with the abnormal payment user after the determining module 440 determines the abnormal payment user according to the at least one transaction feature subsequence of each of the N users.

[0140] It should be understood that the apparatus embodiments and the method embodiments can correspond to each other, and similar descriptions can be referred to the method embodiments. To avoid repetition, details are not described here. Specifically, Figure 4 The apparatus shown can perform Figure 2 and Figure 3 the corresponding method embodiments, and the foregoing and other operations and / or functions of each module in the apparatus are respectively to realize the corresponding procedures in each method in Figure 2 and Figure 3 To be brief, details are not described here.

[0141] The device of the embodiments of the present application is described above from the perspective of functional modules in combination with the drawings. It should be understood that the functional modules can be implemented in the form of hardware, or in the form of instructions of software, or in the form of a combination of hardware and software modules. Specifically, the steps of the method embodiments in the embodiments of the present application can be completed by the integrated logic circuit of hardware in the processor and / or instructions of software. The steps of the method disclosed in the embodiments of the present application can be directly embodied as hardware code processing for execution by the processor, or can be executed by a combination of hardware and software modules in the code processing. Alternatively, the software module can be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, and the like. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method embodiments in combination with the hardware thereof.

[0142] Figure 5 is a schematic block diagram of the server 500 provided by the embodiments of the present application.

[0143] As shown in Figure 5 , the server 500 can include:

[0144] The memory 510 is used to store a computer program and transmit the program code to the processor 520. In other words, the processor 520 can call and run the computer program from the memory 510 to implement the method in the embodiments of the present application.

[0145] For example, the processor 520 can be used to execute the above method embodiments according to the instructions in the computer program.

[0146] In some embodiments of the present application, the processor 520 can include but is not limited to:

[0147] A general processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like.

[0148] In some embodiments of the present application, the memory 510 includes but is not limited to:

[0149] The non-volatile memory can be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory. The volatile memory can be a Random Access Memory (RAM) used as an external cache. By way of example, and not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0150] In some embodiments of the present application, the computer program can be divided into one or more modules, which are stored in the memory 510 and executed by the processor 520 to complete the method provided by the present application. The one or more modules can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the server.

[0151] As shown in Figure 5 The server can further include:

[0152] The transceiver 530 can be connected to the processor 520 or the memory 510.

[0153] The processor 520 can control the transceiver 530 to communicate with other devices, specifically, can send information or data to other devices, or receive information or data sent by other devices. The transceiver 530 can include a transmitter and a receiver. The transceiver 530 can further include an antenna, and the number of antennas can be one or more.

[0154] It should be understood that the various components within the server are connected by a bus system, which includes, in addition to a data bus, a power bus, a control bus, and a state signal bus.

[0155] The application also provides a computer storage medium, which stores a computer program, and the computer program enables a computer to execute the method of the method embodiment when executed by the computer. Alternatively, the application embodiment also provides a computer program product containing instructions, and the instructions enable the computer to execute the method of the method embodiment when executed by the computer.

[0156] When implemented by using software, the computer program product can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions. When loaded and executed by a computer, the computer program instructions produce the flow or function of the embodiment of the application in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through a wired (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) manner. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media sets. The available medium can be a magnetic medium (for example, floppy disk, hard disk, magnetic tape), an optical medium (for example, digital video disc (DVD)), or a semiconductor medium (for example, solid state disk (SSD)) and the like.

[0157] Those skilled in the art can realize that the modules and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the application.

[0158] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the division of the above-described device embodiment is only a logical function division, and there can be another division manner for the actual implementation, for example, multiple devices or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between different parts can be indirect couplings or communication connections through some interfaces, devices or modules, and can be electrical, mechanical or in other forms.

[0159] The modules explained as separated components can or can not be physically separated, and the components shown as modules can or can not be physical modules, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment. For example, the functional modules in each embodiment of the present application can be integrated into a processing module, or each module can be physically present separately, or two or more modules can be integrated into one module.

[0160] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An abnormal transaction processing method characterized by, The method comprises: obtaining at least one transaction information of N users in a preset time period, N being an integer greater than 1; for any one of the N users, performing feature extraction on each transaction information of the user to obtain at least one transaction feature of the user; for any one of the N users, generating at least one transaction feature sub-sequence of the user according to the at least one transaction feature of the user, each transaction feature sub-sequence comprising M consecutive transaction features of the user, M being an integer greater than 1; determining an abnormal payment user according to the at least one transaction feature sub-sequence of each of the N users; wherein the determining of the abnormal payment user according to the at least one transaction feature sub-sequence of each of the N users comprises: determining a first probability and a second probability of any one of the at least one transaction feature sub-sequence of each of the N users; calculating the product of the first probability and the second probability of the transaction feature sub-sequence to obtain a probability product of the transaction feature sub-sequence; determining an abnormal payment user according to the probability product corresponding to the at least one transaction feature sub-sequence of each of the N users; wherein the first probability is the probability of the transaction feature sub-sequence appearing in all transaction feature sub-sequences of the user to which the transaction feature sub-sequence belongs; and the second probability is obtained by taking the logarithm of a first quotient or a second quotient, the first quotient being a quotient obtained by dividing the total number of users by the number of users containing the transaction feature sub-sequence, and the second quotient being a quotient obtained by dividing the total number of users by the sum of 1 and the number of users containing the transaction feature sub-sequence.

2. The method of claim 1, wherein, The determining of the abnormal payment user according to the probability product corresponding to the at least one transaction feature sub-sequence of each of the N users comprises: determining the first P transaction feature sub-sequences in descending order of the probability product corresponding to each of the at least one transaction feature sub-sequence of each of the N users, P being a positive integer; determining an abnormal payment user according to the user corresponding to the first P transaction feature sub-sequences.

3. The method of claim 2, wherein, The determining of the abnormal payment user according to the user corresponding to the first P transaction feature sub-sequences comprises: determining the user corresponding to the first P transaction feature sub-sequences as an abnormal payment user.

4. The method of claim 2, wherein, The determining of the abnormal payment user according to the user corresponding to the first P transaction feature sub-sequences comprises: determining the user corresponding to the first P transaction feature sub-sequences as a suspected abnormal payment user; determining the proportion of suspected abnormal payment users in the payers corresponding to any one of the N users; if the proportion of suspected abnormal payment users in the payers corresponding to the payee is greater than a preset proportion, determining the payee as an abnormal payment user.

5. The method according to any one of claims 1 to 4, characterized in that, The method further comprises, before the calculating of the product of the first probability and the second probability of the transaction feature sub-sequence to obtain the probability product of the transaction feature sub-sequence: If a first probability of any one of the at least one transaction feature subsequence of each of the N users is less than a preset probability, the any one of the at least one transaction feature subsequence is deleted.

6. The method according to any one of claims 1 to 4, characterized in that, The generating, for any one of the N users, of the at least one transaction feature subsequence of the user according to the at least one transaction feature of the user comprises: The generating, for any one of the N users, of the at least one transaction feature subsequence of the user according to the at least one transaction feature of the user comprises:

7. The method of claim 6, wherein, Before the generating, for any one of the N users, of the at least one transaction feature subsequence of the user according to the at least one transaction feature of the user by using the n-gram algorithm, the method further comprises: If adjacent transaction features of the at least one transaction feature of any one of the N users satisfy a preset condition, the adjacent transaction features are merged.

8. The method of claim 7, wherein, The preset condition is that the adjacent transaction features are the same.

9. The method according to any one of claims 1 to 4, characterized in that, The transaction features comprise at least one of a transaction type, a transaction mode, a transaction amount interval, and a transaction time interval.

10. The method according to any one of claims 1 to 4, characterized in that, After the determining of the abnormal payment user according to the at least one transaction feature subsequence of each of the N users, the method further comprises: Intercepting a transaction of the abnormal payment user.

11. The method according to any one of claims 1 to 4, characterized in that, After the determining of the abnormal payment user according to the at least one transaction feature subsequence of each of the N users, the method further comprises: Pushing an alarm message to a user who trades with the abnormal payment user.

12. An abnormal transaction processing apparatus characterized by comprising: The method comprises: An acquisition module is configured to acquire at least one transaction information of N users in a preset time period, N being an integer greater than 1; A feature extraction module is configured to perform feature extraction on each transaction information of any one of the N users to obtain at least one transaction feature of the user; A generation module is configured to generate, for any one of the N users, at least one transaction feature subsequence of the user according to the at least one transaction feature of the user, each transaction feature subsequence comprising continuous M transaction features of the user, M being an integer greater than 1; A determination module is configured to determine an abnormal payment user according to at least one transaction feature subsequence of each of the N users; The determination module is specifically configured to: Determine a first probability and a second probability of any one of the at least one transaction feature subsequence of each of the N users; Calculate a product of the first probability and the second probability of the transaction feature subsequence to obtain a probability product of the transaction feature subsequence; Determine an abnormal payment user according to the probability product corresponding to the at least one transaction feature subsequence of each of the N users; and Determine an abnormal payment user according to the probability product corresponding to the at least one transaction feature subsequence of each of the N users. The first probability is a probability of the transaction feature subsequence appearing in all transaction feature subsequences of the user belonging to the transaction feature subsequence; and the second probability is obtained by taking a logarithm of a first quotient or a second quotient, the first quotient being a quotient obtained by dividing a total number of users by a number of users containing the transaction feature subsequence, and the second quotient being a quotient obtained by dividing the total number of users by a sum of 1 and the number of users containing the transaction feature subsequence.

13. A server, characterized by The method comprises: A processor and a memory, the memory being configured to store a computer program, and the processor being configured to invoke and run the computer program stored in the memory to execute the method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, A computer program product configured to cause a computer to execute the method according to any one of claims 1 to 11.

Images